The LatePoint plugin for WordPress, widely used for appointment booking, contains a critical authentication bypass vulnerability identified as CVE-2024-8943. This vulnerability stems from inadequate verification of the user identity during the booking customer step, specifically when the plugin setting "Use WordPress users as customers" is enabled. An attacker who knows a valid user ID can exploit this flaw to bypass authentication controls and log in as that user, including administrators, without any credentials or interaction. This is classified under CWE-288, which involves authentication bypass via alternate paths or channels. The flaw affects all versions up to and including 5.0.12, with a partial fix in 5.0.12 and a complete fix in 5.0.13. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity due to its network attack vector, no required privileges, no user interaction, and full impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and potential impact make this a high-risk issue for WordPress sites using this plugin with the relevant setting enabled.

The vulnerability allows unauthenticated attackers to gain unauthorized access to any user account on a vulnerable WordPress site, including high-privilege administrator accounts. This can lead to complete site takeover, data theft, modification or deletion of content, installation of backdoors or malware, and disruption of services. The compromise of administrator accounts undermines the integrity and availability of the entire WordPress installation and potentially other integrated systems. Organizations relying on LatePoint for customer bookings face risks of customer data exposure and reputational damage. Since the exploit requires knowledge of user IDs, attackers targeting sites with predictable or enumerated user IDs are at greater risk. The impact extends to any organization using the vulnerable plugin with the affected setting enabled, including small businesses, service providers, and enterprises leveraging WordPress for client management.

Immediate upgrade to LatePoint plugin version 5.0.13 or later is the most effective mitigation, as it fully patches the authentication bypass vulnerability. Until the update can be applied, administrators should disable the "Use WordPress users as customers" setting to prevent exploitation. Additionally, restricting access to the booking customer step via web application firewalls or IP whitelisting can reduce exposure. Site owners should audit user ID enumeration possibilities and implement rate limiting or CAPTCHA challenges to hinder automated attacks. Monitoring logs for suspicious login attempts or unusual activity related to the booking process is recommended. Regular backups and incident response plans should be in place to recover from potential compromises. Finally, educating administrators about the risk and ensuring timely patch management will help prevent exploitation.